+SI-04(13) Analyze Traffic and Event Patterns

SI-04(13) Analyze Traffic and Event Patterns

Control

  1. Analyze communications traffic and event patterns for the system;
  2. Develop profiles representing common traffic and event patterns; and
  3. Use the traffic and event profiles in tuning system-monitoring devices.

Discussion

Identifying and understanding common communications traffic and event patterns help organizations provide useful information to system monitoring devices to more effectively identify suspicious or anomalous traffic and events when they occur. Such information can help reduce the number of false positives and false negatives during system monitoring.

Assessment Objective

    1. communications traffic for the system is analyzed;
    2. event patterns for the system are analyzed;
    1. profiles representing common traffic are developed;
    2. profiles representing event patterns are developed;
    1. traffic profiles are used in tuning system-monitoring devices;
    2. event profiles are used in tuning system-monitoring devices.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation list of profiles representing common traffic patterns and/or events system protocols documentation list of acceptable thresholds for false positives and false negatives system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel responsible for the intrusion detection system

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by SI-04(13) Analyze Traffic and Event Patterns – Assessment Procedure
is blocked by Alert Threshold Tuning